CVE-2016-0763

Published: 24 February 2016

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

From the Ubuntu security team

It was discovered that the Tomcat setGlobalContext method incorrectly checked if callers were authorized. A remote attacker could possibly use this issue to read or wite to arbitrary application data, or cause a denial of service.

Priority

Medium

CVSS 3 base score: 6.3

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0763
• http://seclists.org/bugtraq/2016/Feb/147
• https://ubuntu.com/security/notices/USN-3024-1
• NVD
• Launchpad
• Debian